[et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”4.16″ custom_padding=”||0px|||” da_disable_devices=”off|off|off” global_colors_info=”{}” da_is_popup=”off” da_exit_intent=”off” da_has_close=”on” da_alt_close=”off” da_dark_close=”off” da_not_modal=”on” da_is_singular=”off” da_with_loader=”off” da_has_shadow=”on”][et_pb_row admin_label=”row” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n
Have you already heard about THOR Thunderstorm<\/a>,\u00a0 a self-hosted THOR as a service? In this blog post, we will show how you can leverage THOR Thunderstorm to level up your email infrastructure security.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”3_5,2_5″ _builder_version=”4.23.1″ _module_preset=”default” min_height=”58.5px” global_colors_info=”{}”][et_pb_column type=”3_5″ _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][et_pb_heading title=”THOR Thunderstorm” _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_heading][\/et_pb_column][et_pb_column type=”2_5″ _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2023\/10\/thor-thunderstorm-logo-text.svg” _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n THOR Thunderstorm is a web API wrapped around THOR, which accepts file uploads and returns matches in JSON format. It can process thousands of samples per minute sent from any device within the network. The abilities are seemingly endless, from scanning exotic OSs to integrating custom services (e.g., mail server). Check out this introduction blog<\/a> for a taste of the many use cases of THOR Thunderstrom. Lets get started with some background on Postfix and Milter.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][et_pb_heading title=”Background: Postfix and Milter” _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_heading][et_pb_text _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n The Postfix mail server is a popular and highly configurable Mail Transfer Agent (MTA) used for routing and delivering email messages within a network or across the Internet. Similar to the Sendmail MTA, it can use Milter (protocol) to scan incoming emails for spam or malware. On incoming emails, compatible MTAs use the Milter protocol to communicate with an extra service, which also speaks the Milter protocol. This extra service scans the email and responds with its findings. Based on the response of the extra service the MTA can filter, discard, or quarantine the email. In this blog post, we are releasing an open-source implementation of a Milter Service called “postfix2thunderstorm” which allows you to scan emails using THOR Thunderstorm: https:\/\/github.com\/NextronSystems\/postfix2thunderstorm<\/a> .<\/p>\n [\/et_pb_text][et_pb_heading title=”Bring Postfix To The Next Level” _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_heading][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2023\/11\/p2t.png” title_text=”p2t” align=”center” _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Supercharging your Postfix involves three things:<\/p>\n First, you need to set up THOR Thunderstorm – our manual will help you here<\/a>. Make sure that there are the appropriate firewall rules in place to allow communication between the Milter service and THOR Thunderstrom.<\/p>\n Second, you need the “postfix2thunderstorm” service itself. You can find setup and usage instructions in the GitHub repo<\/a>. Make sure that Postfix is able to reach this service via the network.<\/p>\n Last, you need to configure Postfix to “speak” to the “postfix2thunderstorm” service. To do this, add the following to your Postfix config (\/etc\/postfix\/main.cf) and restart it:<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”]Using this config, every email received by Postfix via SMTP will be forwarded to the “postfix2thunderstorm” service. Based on the response, the email will be quarantined or accepted – see the “postfix2thunderstorm” instructions regarding when emails should be quarantined. In case you need additional help, drop us a line.[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" Have you already heard about THOR Thunderstorm,\u00a0 a self-hosted THOR as a service? In this blog post, we will show how you can leverage THOR Thunderstorm to level up your email infrastructure security.THOR Thunderstorm is a web API wrapped around THOR, which accepts file uploads and returns matches in JSON format. It can process thousands of samples per minute sent from any device within the network. The abilities are seemingly endless, from scanning exotic OSs to integrating custom services (e.g., mail server). Check out this introduction blog for a taste of the many use cases of THOR Thunderstrom. Lets get started with some background on Postfix and Milter.The Postfix mail server is a popular and highly configurable Mail Transfer Agent (MTA) used for routing and delivering email messages within a network or across the Internet. Similar to the Sendmail MTA, it can use Milter (protocol) to scan incoming emails for spam or malware. On incoming emails, compatible MTAs use the Milter protocol to communicate with an extra service, which also speaks the Milter protocol. This extra service scans the email and responds with its findings. Based on the response of the extra service the MTA can filter, discard, or quarantine […]<\/p>\n","protected":false},"author":13,"featured_media":18107,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[749,760,87,32,574,264,269],"tags":[13,149,460,7,61,94,5],"class_list":["post-18106","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-homepage","category-recommended","category-security-monitoring","category-thor","category-thunderstorm","category-tool","category-tutorial","tag-detection","tag-email","tag-gateway","tag-scanner","tag-security-monitoring","tag-server","tag-thor"],"yoast_head":"\n# See https:\/\/www.postfix.org\/MILTER_README.html for more information\n# IP\/Port of host where the postfix2thunderstorm service is running \n# (might be a good idea to make it the localhost (or use TLS)) \nsmtpd_milters = inet:<IP>:<Port> \n# default action in case of error\/timeout\/... \nmilter_default_action = accept \n<\/pre>\n
\nThe “postfix2thunderstorm” service can also be run in the “non-active mode” where all emails are accepted but it is logged if a mail would be quarantined.
\nForward the log lines into your SIEM (or similar) and alert on “warning” level messages to bring your email security to the next level.[\/et_pb_text][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2023\/11\/log.png” title_text=”log” _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_heading title=”Elevating Any Mail Server” _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_heading][et_pb_text _builder_version=”4.23.1″ _module_preset=”default” global_colors_info=”{}”]There are many different mail servers out there. However, almost all of them have some similar mechanism as Postfix with Milter. Based on the informations in this blog post, you should be able to integrate THOR Thunderstorm into any mail server.
\nThe following links might help as well:<\/p>\n\n